From 46d75a3087f3237d06530d55998938e2e2bda6bd Mon Sep 17 00:00:00 2001
From: GammaC0de <gammac0de@users.noreply.github.com>
Date: Wed, 25 Jan 2023 01:53:04 +0200
Subject: [PATCH] make queue/collector links unclickable to prevent XSS

---
 src/pyload/webui/app/themes/modern/static/css/base.css      | 4 ----
 src/pyload/webui/app/themes/modern/templates/js/packages.js | 2 +-
 src/pyload/webui/app/themes/pyplex/templates/js/packages.js | 2 +-
 3 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/src/pyload/webui/app/themes/modern/static/css/base.css b/src/pyload/webui/app/themes/modern/static/css/base.css
index 476f7bc306..909836935e 100644
--- a/src/pyload/webui/app/themes/modern/static/css/base.css
+++ b/src/pyload/webui/app/themes/modern/static/css/base.css
@@ -289,7 +289,3 @@ fieldset[disabled] .btn {
 .modal-dialog {
     margin-top: 10px;
 }
-
-.modal-dialog {
-    margin-top: 10px;
-}
diff --git a/src/pyload/webui/app/themes/modern/templates/js/packages.js b/src/pyload/webui/app/themes/modern/templates/js/packages.js
index 71518c809d..d6afae4539 100644
--- a/src/pyload/webui/app/themes/modern/templates/js/packages.js
+++ b/src/pyload/webui/app/themes/modern/templates/js/packages.js
@@ -176,7 +176,7 @@ function Package (ui, id, ele){
                 link.icon = 'glyphicon glyphicon-cloud-download';
 
             var html = "<span class='child_status'><span style='margin-right: 2px;color: #337ab7;' class='" + link.icon + "'></span></span>\n" +
-                       "<span style='font-size: 16px; font-weight: bold;'><a href='" + link.url + "'>" + link.name + "</a></span><br/>" +
+                       "<span style='font-size: 16px; font-weight: bold;'><a onclick='return false' href='" + link.url + "'>" + link.name + "</a></span><br/>" +
                        "<div class='child_secrow' style='margin-left: 21px; margin-bottom: 7px; border-radius: 4px;'>" +
                        "<span class='child_status' style='font-size: 12px; color:#555; padding-left: 5px;'>" + link.statusmsg + "</span>&nbsp;" + link.error + "&nbsp;" +
                        "<span class='child_status' style='font-size: 12px; color:#555;'>" + link.format_size + "</span>" +
diff --git a/src/pyload/webui/app/themes/pyplex/templates/js/packages.js b/src/pyload/webui/app/themes/pyplex/templates/js/packages.js
index 6b04580aa7..c7b73ee01b 100644
--- a/src/pyload/webui/app/themes/pyplex/templates/js/packages.js
+++ b/src/pyload/webui/app/themes/pyplex/templates/js/packages.js
@@ -176,7 +176,7 @@ function Package (ui, id, ele){
                 link.icon = 'glyphicon glyphicon-cloud-download';
 
             var html = "<span class='child_status'><span style='margin-right: 2px;color: #f9be03;' class='" + link.icon + "'></span></span>\n" +
-                       "<span style='font-size: 16px; font-weight: bold;'><a href='" + link.url + "'>" + link.name + "</a></span><br/>" +
+                       "<span style='font-size: 16px; font-weight: bold;'><a onclick='return false' href='" + link.url + "'>" + link.name + "</a></span><br/>" +
                        "<div class='child_secrow' style='margin-left: 21px; margin-bottom: 7px; border-radius: 4px;'>" +
                        "<span class='child_status' style='font-size: 12px; color:#eee; padding-left: 5px;'>" + link.statusmsg + "</span>&nbsp;" + link.error + "&nbsp;" +
                        "<span class='child_status' style='font-size: 12px; color:#eee;'>" + link.format_size + "</span>" +